DATUM-GLB platform guide

curl -H "Authorization: Bearer $DATUM_ACCESS_TOKEN" http://localhost:8000/workflows/

import { DatumClient } from "@datum-glb/sdk";

const accessToken = process.env.DATUM_ACCESS_TOKEN;
if (!accessToken) throw new Error("Set DATUM_ACCESS_TOKEN");
const client = new DatumClient({
  accessToken,
  baseUrl: process.env.DATUM_API_URL ?? "http://localhost:8000",
});

const workflows = await client.workflows.list();
const risk = await client.models.risk();

import os
from datum_glb import DatumClient

client = DatumClient(
    base_url=os.environ.get("DATUM_API_URL", "http://localhost:8000"),
    access_token=os.environ["DATUM_ACCESS_TOKEN"],
)
workflows = client.workflows.list()
result = client.workflows.run(3, asset_id=1)

export DATUM_API_URL=http://localhost:8000
datum login --email you@company.com
datum asset list
datum model risk --json

import hashlib, json
from cryptography.hazmat.primitives.serialization import load_pem_public_key

# receipt_response comes from GET /ai-activity/{activity_id}/receipt
# public_key_response comes from GET /verify/public-key
if not receipt_response["available"]:
    raise RuntimeError(receipt_response["reason"])
canonical = json.dumps(
    receipt_response["receipt"], sort_keys=True, separators=(",", ":"), ensure_ascii=True
).encode()
digest = hashlib.sha256(canonical).hexdigest()
assert digest == receipt_response["receipt_hash"]
key = load_pem_public_key(public_key_response["public_key_pem"].encode())
key.verify(
    bytes.fromhex(receipt_response["signature"]),
    receipt_response["signed_message"].encode(),
)

import hashlib, hmac
from flask import request

# Keep the exact raw request body; do not parse and re-serialize the JSON.
raw_body = request.get_data(cache=True)
body_text = raw_body.decode("utf-8")
timestamp = request.headers["X-Datum-Timestamp"]
expected = "sha256=" + hmac.new(
    secret.encode(), f"{timestamp}.{body_text}".encode(), hashlib.sha256
).hexdigest()
assert hmac.compare_digest(expected, request.headers["X-Datum-Signature"])

from cryptography.hazmat.primitives.serialization import load_pem_public_key

# head from GET /verify/trust/{slug}/chain-head, pem from GET /verify/public-key
if not head:
    raise RuntimeError("No signed audit-chain head is available")
key = load_pem_public_key(pem.encode())
key.verify(bytes.fromhex(head["signature"]), f"{company_id}.{head['chain_hash']}".encode())